安全
安全扫描与漏洞检测
cryptoeconomic-protocol-security
curiositech
Analyze bonded agent systems, escrow workflows, slashing rules, oracle trust, Sybil cost, and front-running risk in protocols where agents post bonds or stake reputation. Use for collateral sizing, griefing analysis, dispute design, and bonded-agent security reviews. NOT for smart contract auditing, DeFi tokenomics, blockchain consensus design, or trading strategy.
content-security-policy-headers
curiositech
'Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.'
infra-code-review
yarlson
This skill should be used when the user asks to "review my infra changes", "review my IaC", "check my infrastructure code", "review this deploy config", "review my cloud config", "review infra before I push", or mentions reviewing, auditing, or analyzing infrastructure-as-code changes — any tool, any cloud, any format.
security-pattern-check
kjgarza
Identify security vulnerabilities and anti-patterns providing feedback on security issues a senior developer would catch. Use when user mentions security/vulnerability/safety concerns, code involves user input/authentication/data access, working with sensitive data (passwords/PII/financial), code includes SQL queries/file operations/external API calls, user asks about security best practices, or security-sensitive files are being modified (auth, payment, data access).
django-security
peopleforrester
Django security best practices. Covers CSRF, XSS, SQL injection prevention, authentication hardening, Content Security Policy, secrets management, and Django-specific security middleware configuration.
skeptic-argument-quality
data219
Use when evaluating claim- or hypothesis-driven prompts where hidden assumptions, evidence quality, or reasoning validity may distort engineering or delivery decisions.
django-verification
peopleforrester
Pre-deployment verification workflow for Django projects. Covers migration checks, security audit, performance profiling, dependency scanning, deployment readiness, and production configuration validation.
springboot-security
peopleforrester
Spring Security 6.x best practices. Covers SecurityFilterChain, JWT auth, OAuth2, CORS, CSRF, method-level security, password encoding, and rate limiting for Spring Boot 3.x applications.
skeptic-architecture
data219
Use when reviewing architecture decisions for single points of failure, rollback readiness, operability, scaling assumptions, and production reliability tradeoffs.
verification-loop
peopleforrester
Pre-PR quality verification workflow. Runs build, type-check, lint, test, security scan, and coverage analysis in sequence. Stops on first failure and reports actionable fixes. Use before creating pull requests.
security-audit-saas-generic
danielcubas
Perform a full security audit for any SaaS web application regardless of specific framework or ORM. Use before production or after MVP completion.
dependency-updater
cachemoney
Smart dependency management for any language. Auto-detects project type, applies safe updates automatically, prompts for major versions, diagnoses and fixes dependency issues.
eval-harness
peopleforrester
Structured evaluation framework for measuring code quality across multiple dimensions. Provides repeatable, scored assessments with evidence-based ratings.
cirra-ai-sf-audit
cirra-ai
Run a comprehensive Salesforce org audit. Inventories and scores Apex classes, Apex triggers, Flows, Process Builders, Workflow Rules, LWC components, custom objects and fields, validation rules, Profiles, and Permission Sets. Generates Word, Excel, and HTML reports. Supports incremental audits that only re-score changed components. Use when asked to audit a Salesforce org, review org health, generate an org inventory, run an org health check, audit permissions, review the data model, or audit apex flows and lwc.
convex
aaronvanston
Convex backend development - queries, mutations, actions, schemas, indexes, realtime subscriptions, optimistic updates, file storage, HTTP endpoints, webhooks, cron jobs, migrations, AI/LLM agents, RAG, security, authentication, authorization, rate limiting, error handling with ConvexError, code review, convex-helpers, custom functions, triggers, row-level security, relationship helpers, Hono, CORS, Zod validation, CRUD, manual pagination, QueryStreams, query caching, sessions, workpool, components, RBAC, audit trails. Use when writing Convex functions, defining schemas, building real-time features, integrating external APIs, handling file uploads, setting up scheduled jobs, performing database migrations, building AI chat interfaces, reviewing Convex code for production readiness, using convex-helpers patterns, or building reusable Convex components.
security-check
schroneko
Security check skill. Triggers on "Could you please run a security check?", "セキュリティチェックをお願いします。", "请帮我做一次安全检查。". セキュリティチェックのデモスキル。「セキュリティチェックをお願いします。」「请帮我做一次安全检查。」などのリクエストで発動する。
consistency-auditor
dangeles
Use when parameter values appear in multiple documents and consistency must be verified, especially for quantitative values that may differ due to measurement context or require reconciliation
Agent Router
udapy
Analyzing user intent and delegating tasks.
agent-native-audit
ratacat
Run comprehensive agent-native architecture review with scored principles
sensitive-content-scanner
dazuck
Scan files for sensitive content before sharing. Detects personal info, credentials, private URLs, local paths, and security risks. Use before publishing repos, sharing code, or exporting configs.
personalize-skills
dazuck
Customize Operator Skills for your environment. Use when first installing skills or when you want to update your personal values.
role-definitions
kbrdn1
Skill migrated from _fragments/base/role-definitions
security
kbrdn1
Skill migrated from _fragments/backend/security
SkillSync MCP — Security-Gated Skill Manager
adityasugandhi
Critical threats (prompt injection, RCE, credential theft) permanently block installation. Medium/high risk requires explicit force: true. All output is sanitized against prompt injection.